virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...

CVE-2026-93371

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371 marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

CVE-2026-93371

A command injection vulnerability exists in marcopiovanello/yt-dlp-web-ui up to v4 , specifically in the NewGenericDownload function within server/internal/downloaders/generic.go. Manipulation of the params argument allows a remote, unauthenticated attacker to execute arbitrary commands with no u...

EUVD-2026-82640

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack...

PYSEC-2026-4014 Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator withno escaping at all. --prompt, the VIRTUALENVPROMPT environment variable,and the config file all set the prompt, and activate.bat writes it straightinto @set "VAR=value". A prompt containing a double quote closes that...

EUVD-2026-82590

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82582

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-82588

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

PT-2026-95508

Name of the Vulnerable Software and Affected Versions spatie Scotty versions prior to 1.4.5 Description OS command injection is possible via remote attack in the Doctor Command Handler component. The issue exists within the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools...

CVE-2026-93533: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

PT-2026-95225

Name of the Vulnerable Software and Affected Versions marcopiovanello yt-dlp-web-ui versions prior to v5 Description Remote command injection is possible through the manipulation of the params argument within the NewGenericDownload function located in the server/internal/downloaders/generic.go...

CVE-2026-84082: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84071: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in...

CVE-2026-84085: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-82892: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-82887: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...